
Please replace the title beginning at page 1, line 
1, with the following rewritten title: 

GENERATING PATH-CENTRIC TRAFFIC INFORMATION FOR ANALYSIS 
USING AN ASSOCIATION OF A SS OCIATING PACKET -CENTRIC 
INFORMATION SAMPLE S WITH TO PATH-CENTRIC INFORMATION FOR 
ACCRECATION 

Please replace the Abstract beginning at page 27, 
line 3, with the following rewritten Abstract: 

Samples from an addressed data forwarding devices, 
such as a router, are associated with path-centric 
information. Information from the samples and/ or the is 
used to update corresponding path-centric traffic 
information is used to aggregated traffic information , 
such as flow information for example . The aggregated 
path-centric traffic information can then be used- — fe* 1 
**se by traffic analysis operations. 
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The following is a listing of claims in the 
application: 



1 Claim 1 (original) : A method for generating traffic 

2 information for analysis, the method comprising: 

3 a) accepting at least one sample derived from 

4 addressed data; 

5 b) determining path-centric information based on the 

6 accepted at least one sample; and 

7 c) adjusting a traffic metric of a traffic parameter 

8 based on the determined path-centric information. 



1 Claim 2 (original) : The method of claim 1 wherein the 

2 addressed data is a packet. 

1 Claim 3 (original) : The method of claim 1 wherein the 

2 sample includes information from the header of a packet. 

1 Claim 4 (original) : The method of claim 1 wherein the act 

2 of determining path-centric information based on the 

3 accepted at least one sample includes using at least a part 

4 of the at least one sample as a search key to find an item 

5 with a closest matching key in a data structure. , 



1 Claim 5 (original) : The method of claim 4 wherein the data 

2 structure is a searchable data structure selected from a 

3 group consisting of (A) a hash table, (B) a binary search 

4 tree, and (C) a trie. 
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1 Claim 6 (original) : The method of claim 1 wherein the act 

2 of determining path-centric information based on the 

3 accepted at least one sample includes: 

4 i) using at least a part of the at least one 

5 sample as a search key to find a first item with 

6 a closest matching key in a first data structure; 

7 and 

8 ii) using at least a part of the first item 

9 found as a search key to find a second item with 
10 a matching key in a second data structure. 

1 Claim 7 (original) : The method of claim 6 wherein the 

2 second item includes path-centric information. 

1 Claim 8 (original) : The method of claim 6 wherein the 

2 second item includes an origin autonomous system and a peer 

3 autonomous system. 

1 Claim 9 (original) : The method of claim 6 wherein the 

2 second item includes an autonomous system path. 

1 Claim 10 (original) : The method of claim 6 wherein the 

2 first and second data structures are tries. 

1 Claim 11 (original) : The method of claim 6 wherein the 

2 first data structure is a Radix trie. 

1 Claim 12 (original) : The method of claim 6 wherein the at 

2 least a part of the at least one sample used as a search 

3 key is an internet protocol prefix. 
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1 Claim 13 (original) : The method of claim 6 wherein the at 

2 least a part of the at least one sample, used as a search 

3 key is at least one of (A) a source address and (B) a 

4 destination address. 



1 Claim 14 (original) : The method of claim 6 wherein the at 

2 least a part of the first item found used as a search key 

3 is an autonomous system index. 



1 Claim 15 (original) : The method of claim 1 wherein the 

2 sample includes at least two parameters selected from a 

3 group parameters consisting of (A) a source address, (B) a 

4 destination address, (C) a protocol, (D) a source port, (E) 

5 a destination port, (F) an interface number, (G) a type of 

6 service, (H) an SNMP index, (I) a kernel logical interface 

7 index, and (J) a type of interface indice. 

1 Claim 16 (original) : The method of claim 1 wherein the 

2 path-centric information determined includes an origin 

3 autonomous system and a peer autonomous system. 



1 Claim 17 (original) : The method of claim 1 wherein the 

2 path-centric information determined includes an autonomous 

3 system path. 



1 Claim 18 (original): The method of claim 1 wherein the act 

2 of adjusting a traffic metric of a traffic parameter based 

3 on the determined path-centric information includes: 

4 i) using a part of the determined path-centric 

5 information as a key to search items of traffic 

6 parameters; 
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7 ii) if a traffic parameter with a matching key 

8 is found, incrementing its traffic metric; 

9 iii) if none of the traffic parameters has a 
10 matching key, creating a new item. 

1 Claim 19 (original) : The method of claim 1 wherein the 

2 traffic metric adjusted is at least one of (A) a byte count 

3 and (B) a packet count. 

1 Claim 2 0 (original) : The method of claim 1 wherein the 

2 traffic parameter is selected from a group of traffic 

3 parameters consisting of (A) a particular pair of source 

4 and destination addresses, (B) a particular pair of source 

5 and destination ports, and (C) a particular pair of 

6 autonomous systems . 

1 Claim 21 (previously presented) : A method for generating 

2 data structures for mapping information in a sample derived 

3 from addressed data, to path-centric information, the 

4 method comprising: 

5 a) using network information, building a first data 

6 structure including items of a first type, each of the 

7 items of the first type including an autonomous system 

8 index and an internet protocol prefix, wherein the 

9 internet protocol prefix is a key; and 

10 b) using network information, building a second data 

11 structure including items of a second type, each of 

12 ' the items of the second type including an autonomous 

13 system index and an autonomous system path, wherein 

14 the autonomous system index is a key, 
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15 wherein the first and second data structures 

16 may be used for generating traffic information for 

17 analysis. 

1 Claim 22 (original) : The method of claim 21 wherein the 

2 first and second data structures are tries. 

1 Claim 23 (original) : The method of claim 21 wherein the 

2 first data structure is a Radix trie. 

1 Claim 24 (original) : The method of claim 21 wherein the 

2 network information was derived from routing information. 

1 Claim 25 (original) : An apparatus for generating traffic 

2 information for analysis, the apparatus comprising: 

3 a) an input for accepting at least one sample derived 

4 from addressed data; 

5 b) means for determining path-centric information 

6 based on the accepted at least one sample; and 

7 c) means for adjusting a traffic metric of a traffic 

8 parameter based on the determined path-centric 

9 information. 

1 Claim 2 6 (original) : The apparatus of claim 2 5 wherein the 

2 means for determining path-centric information based on the 

3 accepted at least one sample include a searching facility, 

4 the search facility (i) using at least a part of the at 

5 least one sample as a search key to find a first item with 

6 a closest matching key in a first data structure, and (ii) 

7 using at least a part of the first item found as a search 

8 key to find a second item with a matching key in a second 

9 data structure. 
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1 Claim 27 (original) : The apparatus of claim 2 6 wherein the 

2 second item includes path-centric information. 

1 Claim 28 (original) : The apparatus of claim 26 wherein the 

2 second item includes an origin autonomous system and a peer 

3 autonomous system. 



1 Claim 29 (original) : The apparatus of claim 2 6 wherein the 

2 second item includes an autonomous system path. 

1 Claim 30 (original) : The apparatus of claim 25 wherein the 

2 means for adjusting a traffic metric of a traffic parameter 



3 based on the determined path-centric information include 

4 i) a search facility, using a part of the 

5 determined path-centric information as a key to 

6 search items of traffic parameters; and 

7 ii) an aggregator, wherein if a traffic 

8 parameter with a matching key is found, the 

9 aggregator increments the traffic metric of the 

10 traffic parameter, and wherein if none of the 

11 traffic parameters has a matching key, the 

12 aggregator creates a new item. 

1 Claim 31 (original) : The apparatus of claim 25 wherein the 

2 traffic parameter is selected from a group of traffic 

3 parameters consisting of (A) a particular pair of source 

4 and destination addresses, (B) a particular pair of source 

5 and destination ports, and (C) a particular pair of 

6 autonomous systems. 



1 Claim 32 (original) : A data forwarding device comprising: 
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2 a) an addressed data forwarding facility for 

3 forwarding addressed data based on forwarding 

4 information; 

5 b) a routing facility for determining and 

6 disseminating network state information, and for 

7 generating path information based on the network state 

8 information; 

9 c) a sampler for generating samples based on accepted 

10 addressed data; 

11 d) means for determining path-centric information 

12 based on the samples generated by the sampler; and 

13 e) means for adjusting a traffic metric of a traffic 

14 parameter based on the determined path-centric 

15 information. 

1 Claim 33 (original) : The data forwarding device of claim 

2 32 wherein the routing facility effects a exterior gateway 

3 protocol . 

1 Claim 34 (original) : The data forwarding device of claim 

2 32 wherein the routing facility effects a border gateway 

3 protocol . 

1 Claim 3 5 (previously presented) : A data forwarding device 

2 comprising: 

3 a) an addressed data forwarding facility for 

4 forwarding addressed data based on forwarding 

5 information; 

6 b) a routing facility for determining and 

7 disseminating network state information, and for 

8 generating path information based on the network state 

9 information; 



9 



10 c) means, using the path information generated by the 

11 routing facility, for building a first data structure 

12 including items of a first type, each of the items of 

13 the first type including an autonomous system index 

14 and an internet protocol prefix, wherein the internet 

15 protocol prefix is a key; and 

16 d) means, using the path information generated by the 

17 routing facility, for building a second data structure 

18 including items of a second type, each of the items of 

19 the second type including an autonomous system index 
2 0 and an autonomous system path, wherein the autonomous 

21 system index is a key, 

22 wherein the first and second data structures may 

23 be used for generating traffic information for analysis. 

1 Claim 3 6 (original) : The data forwarding device of claim 

2 3 5 further comprising: 

3 e) a sampler for generating samples based on accepted 

4 addressed data; 

5 f) means for determining path-centric information 

6 based on (i) the samples generated by the sampler, 

7 (ii) the first data structure, and (iii) the second 

8 data structure; and 

9 g) means for adjusting a traffic metric of a traffic 

10 parameter based on the determined path-centric 

11 information. 

1 Claim 37 (previously presented) : A machine- readable medium 

2 having stored thereon: 

3 a) a first data structure including items of a first 

4 type, each of the items of the first type including an 
5. autonomous system index and an internet protocol 
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prefix, wherein the internet protocol prefix is a key; 
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and 
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10 



8 



9 



b) a second data structure including items of a 
second type, each of the items of the second type 
including an autonomous system index and an autonomous 
system path, wherein the autonomous system index is a 
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key, 



13 



wherein the first and second data structures may 



14 be used for generating traffic information for analysis. 

1 Claim 3 8 (original) : The machine-readable medium of claim 

2 37 wherein the first and second data structures are tries. 

1 Claim 39 (original) : The machine-readable medium of claim 

2 37 wherein the first data structure is a Radix trie. 

1 Claim 40 (original) : The machine-readable medium of claim 

2 37 further comprising: 

3 c) network information derived from routing 

4 information. 
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